03-starboard-operator.config.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: starboard
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.6"
    app.kubernetes.io/managed-by: kubectl
---
apiVersion: v1
kind: Secret
metadata:
  name: starboard-trivy-config
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.6"
    app.kubernetes.io/managed-by: kubectl
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: starboard
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.6"
    app.kubernetes.io/managed-by: kubectl
data:
  vulnerabilityReports.scanner: "Trivy"
  configAuditReports.scanner: "Polaris"
  kube-bench.imageRef: "docker.io/aquasec/kube-bench:v0.6.6"
  compliance.failEntriesLimit: "10"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: starboard-trivy-config
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.6"
    app.kubernetes.io/managed-by: kubectl
data:
  trivy.imageRef: "docker.io/aquasec/trivy:0.25.2"
  trivy.mode: "Standalone"
  trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
  trivy.timeout: "5m0s"
  trivy.dbRepository: "ghcr.io/aquasecurity/trivy-db"
  trivy.resources.requests.cpu: 100m
  trivy.resources.requests.memory: 100M
  trivy.resources.limits.cpu: 500m
  trivy.resources.limits.memory: 500M
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: starboard-polaris-config
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.6"
    app.kubernetes.io/managed-by: kubectl
data:
  polaris.imageRef: "quay.io/fairwinds/polaris:4.2"
  polaris.resources.requests.cpu: "50m"
  polaris.resources.requests.memory: "50M"
  polaris.resources.limits.cpu: "300m"
  polaris.resources.limits.memory: "300M"
  polaris.config.yaml: |
    checks:
      # reliability
      multipleReplicasForDeployment: ignore
      priorityClassNotSet: ignore
      # resources
      cpuRequestsMissing: warning
      cpuLimitsMissing: warning
      memoryRequestsMissing: warning
      memoryLimitsMissing: warning
      # images
      tagNotSpecified: danger
      pullPolicyNotAlways: ignore
      # healthChecks
      readinessProbeMissing: warning
      livenessProbeMissing: warning
      # networking
      hostNetworkSet: warning
      hostPortSet: warning
      # security
      hostIPCSet: danger
      hostPIDSet: danger
      notReadOnlyRootFilesystem: warning
      privilegeEscalationAllowed: danger
      runAsRootAllowed: warning
      runAsPrivileged: danger
      dangerousCapabilities: danger
      insecureCapabilities: warning
    exemptions:
      - controllerNames:
        - kube-apiserver
        - kube-proxy
        - kube-scheduler
        - etcd-manager-events
        - kube-controller-manager
        - kube-dns
        - etcd-manager-main
        rules:
        - hostPortSet
        - hostNetworkSet
        - readinessProbeMissing
        - livenessProbeMissing
        - cpuRequestsMissing
        - cpuLimitsMissing
        - memoryRequestsMissing
        - memoryLimitsMissing
        - runAsRootAllowed
        - runAsPrivileged
        - notReadOnlyRootFilesystem
        - hostPIDSet
      - controllerNames:
        - kube-flannel-ds
        rules:
        - notReadOnlyRootFilesystem
        - runAsRootAllowed
        - notReadOnlyRootFilesystem
        - readinessProbeMissing
        - livenessProbeMissing
        - cpuLimitsMissing
      - controllerNames:
        - cert-manager
        rules:
        - notReadOnlyRootFilesystem
        - runAsRootAllowed
        - readinessProbeMissing
        - livenessProbeMissing
      - controllerNames:
        - cluster-autoscaler
        rules:
        - notReadOnlyRootFilesystem
        - runAsRootAllowed
        - readinessProbeMissing
      - controllerNames:
        - vpa
        rules:
        - runAsRootAllowed
        - readinessProbeMissing
        - livenessProbeMissing
        - notReadOnlyRootFilesystem
      - controllerNames:
        - datadog
        rules:
        - runAsRootAllowed
        - readinessProbeMissing
        - livenessProbeMissing
        - notReadOnlyRootFilesystem
      - controllerNames:
        - nginx-ingress-controller
        rules:
        - privilegeEscalationAllowed
        - insecureCapabilities
        - runAsRootAllowed
      - controllerNames:
        - dns-controller
        - datadog-datadog
        - kube-flannel-ds
        - kube2iam
        - aws-iam-authenticator
        - datadog
        - kube2iam
        rules:
        - hostNetworkSet
      - controllerNames:
        - aws-iam-authenticator
        - aws-cluster-autoscaler
        - kube-state-metrics
        - dns-controller
        - external-dns
        - dnsmasq
        - autoscaler
        - kubernetes-dashboard
        - install-cni
        - kube2iam
        rules:
        - readinessProbeMissing
        - livenessProbeMissing
      - controllerNames:
        - aws-iam-authenticator
        - nginx-ingress-default-backend
        - aws-cluster-autoscaler
        - kube-state-metrics
        - dns-controller
        - external-dns
        - kubedns
        - dnsmasq
        - autoscaler
        - tiller
        - kube2iam
        rules:
        - runAsRootAllowed
      - controllerNames:
        - aws-iam-authenticator
        - nginx-ingress-controller
        - nginx-ingress-default-backend
        - aws-cluster-autoscaler
        - kube-state-metrics
        - dns-controller
        - external-dns
        - kubedns
        - dnsmasq
        - autoscaler
        - tiller
        - kube2iam
        rules:
        - notReadOnlyRootFilesystem
      - controllerNames:
        - cert-manager
        - dns-controller
        - kubedns
        - dnsmasq
        - autoscaler
        - insights-agent-goldilocks-vpa-install
        - datadog
        rules:
        - cpuRequestsMissing
        - cpuLimitsMissing
        - memoryRequestsMissing
        - memoryLimitsMissing
      - controllerNames:
        - kube2iam
        - kube-flannel-ds
        rules:
        - runAsPrivileged
      - controllerNames:
        - kube-hunter
        rules:
        - hostPIDSet
      - controllerNames:
        - polaris
        - kube-hunter
        - goldilocks
        - insights-agent-goldilocks-vpa-install
        rules:
        - notReadOnlyRootFilesystem
      - controllerNames:
        - insights-agent-goldilocks-controller
        rules:
        - livenessProbeMissing
        - readinessProbeMissing
      - controllerNames:
        - insights-agent-goldilocks-vpa-install
        - kube-hunter
        rules:
        - runAsRootAllowed